The flaw in frab allows an authenticated crew user to grant themselves the organisation (orga) role by submitting unchecked nested conference_users_attributes in the UsersController. This bypasses the expected filter that should prevent non‑admin users from assigning organisational privileges. The vulnerability is a credential‑based privilege escalation (CWE‑269) that would let the attacker fully manage events, schedules, reviewers, and other crew members on any conference.

The product affected is frab, version 0.9.1 and all earlier releases. Systems that have not incorporated the fix found in the referenced commit or in later releases that include the protective change are vulnerable.

Exploitation requires authentication as a crew user, so the threat surface is limited to legitimate user accounts. Attackers can provide the unchecked nested attributes during a request to UsersController#update or #create, which skip the filter, thus elevating their access to an organisation role with full administrative control. The CVSS score of 8.6 signals high severity, and the absence of an EPSS value and a KEV listing suggests that while the vulnerability is of high impact, its exploitation probability is currently unknown but non‑negligible.